In some cases, vulnerabilities such as CVE-2021-44228 (Log4Shell) appear in Balbix with an exposure score and asset context, but no fix or remediation information is displayed under the Details tab. The screen may show the message “No Fixes Available.”
Root Cause
This behavior occurs when Host Analyzer (HA) detects a vulnerable component inside a packaged application, such as a .jar file. In these cases, the vulnerability is found at the component level (for example, a log4j-core class within an application JAR) rather than as a directly installed or independently managed software package.
Because HA identifies the vulnerable component through deep file inspection rather than a package manager or known patchable version, Balbix cannot automatically determine or recommend a fix for the enclosing application. This limitation applies not only to Log4Shell but also to other components discovered through HA-based inspection, such as certain Cisco network device components or custom application bundles.
Expected Behavior
The asset will correctly display its exposure score, severity, and associated CVE.
The Remediation field will show “No Fixes Available” when:
The vulnerable component is embedded in an application JAR or similar container.
No upstream vendor patch mapping exists for that asset.
The fix cannot be automatically inferred from available package metadata.